Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bd9a3bc50f3ecfc434b0028f3ded4491fa735e837623f268c7bbf4adf0ccf3e9.zip

  • Size

    584KB

  • Sample

    220913-13ptjsgff9

  • MD5

    aedf7cb991a3bcac931e9288546b377e

  • SHA1

    27fefa1ae02596f8a454fd5076427b3f657313ee

  • SHA256

    e2cb0508f1aae0f0b83d62d137f9b488c82dce051e13b8545fd04d7c29a7bde4

  • SHA512

    0f438ff33cec0ec39a5d74506137ce7286d07b5c13b14e7f41ad27bec489cb1407677f0da8c8f35e7a9ea425a66bdd80a81b10fc31b72d6de122dfc5c82fcf0d

  • SSDEEP

    12288:AqVP7/1qcEbLl5ipgjKUrBcNf3JLPaaurGwDk9oL6pxR/S6VuiK:AqVj/1qcEPipTy8flPLuawDYoLmxRasK

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.rimiapparelsltd.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Ijeomam28@

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      bd9a3bc50f3ecfc434b0028f3ded4491fa735e837623f268c7bbf4adf0ccf3e9.exe

    • Size

      891KB

    • MD5

      1179dd8e427142d60d82f588fcdb2138

    • SHA1

      03cb870e3ba8994943709b0f6c15bde9ebe20d04

    • SHA256

      bd9a3bc50f3ecfc434b0028f3ded4491fa735e837623f268c7bbf4adf0ccf3e9

    • SHA512

      cc4cb1d1291fce22a637722c47a92f78e5bba894fe6cd3429189bc3807b4d8bd52b55c104ce51f07b8995663167555b08e037bdb3b6ceb17ab0b58ecb9e765fc

    • SSDEEP

      12288:DUx1l4E2P1dzsCBW/T9smPym20WJ5oxswsJ42//1NjoIHN:gt4E2P1dzsCqRXWLox5sXnfkk

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks